Splunk Search

How to Merge count two different field values

Manasi25
Explorer

I have different Fields values like - teamNameTOC, teamNameEngine  under same field Name(teamName) want to merge these two values in single report.

I have tried below and output also attached

teamName=DA OR teamName=DBA OR teamName=Engine OR teamName=SE OR teamName=TOC | top limit=50 teamName

OUTPUT 

teamName count percent
TOC 233 50.000000
Engine 84 18.025751
DA 66 14.163090
SE 55 11.802575
DBA 28


I need all above values Count (team name , count , %) in one row as single entity. % should adjust itself if add new more values.

Output should look like - 

teamName count percent

All Teams 466 100.00

 

 

 

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

You should be able to do that with the append command.

teamName=DA OR teamName=DBA OR teamName=Engine OR teamName=SE OR teamName=TOC | top limit=50 teamName
| stats sum(count) as count, sum(percent) as percent
| eval teamName = "IA"
| append [teamName=A OR teamName=B OR teamName=C OR teamName=D | top limit=50 teamName
| stats sum(count) as count, sum(percent) as percent
| eval teamName = "IB" ]
| table teamName, count, percent

If your problem is resolved, then please click the "Accept as Solution" button to help future readers.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

It's not clear what the final result should be.  If you want a total row in addition to the existing results then try this search:

teamName=DA OR teamName=DBA OR teamName=Engine OR teamName=SE OR teamName=TOC | top limit=50 teamName
| addcoltotals labelfield=teamName label="All Teams"
---
If this reply helps you, Karma would be appreciated.
0 Karma

Manasi25
Explorer

HI. Thank you for reply.

Solution you given resulted same as mine mentioned commands.

I need "All Teams"'s count  ONLY the output and want to rename "All teams" as a "IA".

Manasi25_0-1596686813600.png

 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try this:

teamName=DA OR teamName=DBA OR teamName=Engine OR teamName=SE OR teamName=TOC | top limit=50 teamName
| stats sum(count) as count, sum(percent) as percent
| eval teamName = "IA"
| table teamName, count, percent
---
If this reply helps you, Karma would be appreciated.
0 Karma

Manasi25
Explorer

Thank you so much ! Its worked good.

Kindly let me know, how can I add one more row of another fields to get result as below- 

I have field values for "IB" and need to add row below the result  of"IA".

Fileds Values -

teamName=A OR teamName=B OR teamName=C OR teamName=D OR teamName=E | top limit=50 teamName   

 

RoutingKey    Count   Percentage

IA                         250        100.00

IB                         count             %

0 Karma

richgalloway
SplunkTrust
SplunkTrust

You should be able to do that with the append command.

teamName=DA OR teamName=DBA OR teamName=Engine OR teamName=SE OR teamName=TOC | top limit=50 teamName
| stats sum(count) as count, sum(percent) as percent
| eval teamName = "IA"
| append [teamName=A OR teamName=B OR teamName=C OR teamName=D | top limit=50 teamName
| stats sum(count) as count, sum(percent) as percent
| eval teamName = "IB" ]
| table teamName, count, percent

If your problem is resolved, then please click the "Accept as Solution" button to help future readers.

---
If this reply helps you, Karma would be appreciated.

Manasi25
Explorer

Thank you so much ! It worked.

0 Karma

Manasi25
Explorer

Hi Rich

 

Solution you given worked perfectly, but its parsing my output and getting time for result.

Also, I need average of all results , but it do sum of all avg in Totals. Plz advise.

Manasi25_1-1599377950303.png

 

 

Manasi25_0-1599377885430.png

 

 

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...